6 ms·

Researchers quietly cracked Zeppelin ransomware keys

• Eddy_Viscosity2 4y ago
  Minor rant. I wish people would stop putting 'quietly' in headlines. Are we expected to believe that they did this in total silence without talking to each other or listening to music as they worked? Ridiculous! In seriousness though, 'quietly' is clickbait meant to imply this they were doing it secretly for some nefarious purpose. Also the fact that there is an article about it contradicts that meaning of quietly as its being published to the public. /end rant
• throwawybllion 4y ago
  > By the time Jon’s company got around to decrypting their data, they were forced by regulators to prove that no patient data had been exfiltrated from their systems. There is absolutely no way they could have proven that...
  • deleted 4y ago
    [deleted]
  • WrtCdEvrydy 4y ago
    > There is absolutely no way they could have proven that... Our firewall says it's fine....
    • CaliforniaKarl 4y ago
      Yup. Records of inbound/outbound connections might be enough.
      • hsbauauvhabzb 4y ago
        If a network has been built such that your backups can be compromised by ransomware, I’d doubt network traffic is logged to an immutable store, if at all.
• rob-olmos 4y ago
  > “The challenge was that they delete the [public key] once the files are fully encrypted. Memory analysis gave us about a 5-minute window after files were encrypted to retrieve this public key.” > Unit 221B ultimately built a “Live CD” version of Linux that victims could run on infected systems to extract that RSA-512 key. I'm guessing most didn't make it within the 5-min window, so the Live CD would recover the "deleted" record from the Windows Registry database?
  • system2 4y ago
    I am puzzled by the statement too. Live CD means restarting the host and boot it with that CD then retrieve whatever. I doubt that CD is sitting next to people got encrypted when it happens.
    • jsmith99 4y ago
      Presumably it means you need to turn the computer off within 5m of the encryption occuring and don't turn it on again till you boot the live cd?
  • splonk 4y ago
    The more technical writeup [0] linked at the bottom of the article doesn't specifically mention it, but it sounds like they probably booted off the Live CD to get access to the registry. > You can’t analyze the registry live on a windows machine because it locks the NTUSER.dat files by the process id (PID) 104 known as Registry.exe. Any useful registry information will be found in that process, and we recommend getting a memory and VAD dump of the Registry.exe process as soon as possible. You can do this quite easily with the REKALL tool, which can perform live and dead memory analysis on Windows machines. [0]: https://blog.unit221b.com/dont-read-this-blog/0xdead-zeppelin https://blog.unit221b.com/dont-read-this-blog/0xdead-zeppeli...
    • Someone 4y ago
      Reading between the lines, I get the impression the key is deleted from the registry, but not explicitly erased, allowing recovery if the disk space isn’t reused yet. “Since Zeppelin deletes the registry key store, we will have to extract unallocated cells from the registry to recover the Public Key section. […] We have had 100% success carving the public key from NTUser.dat for live Zeppelin samples in the field”
• pxmpxm 4y ago
  > call from an FBI agent. “Don’t pay,” the agent said. “We’ve found someone who can crack the encryption.” Weird, you'd think this would be the exact time for some three letter agency to apply the xkcd $5 wrench approach: Black bag rendition one of the principals, beat the private key out of him and publicize the entire thing. You only have to do it once, really.
  • gregschlom 4y ago
    The malware authors are in Russia, how's the FBI going to go after them?
    • aliqot 4y ago
      duh, a longer wrench
      • randmeerkat 4y ago
        > duh, a longer wrench Would that make it a $10 wrench?
        • _puk 4y ago
          Or a wrēnch..
    • hsbauauvhabzb 4y ago
      Australia is currently trying to do this with revil over the Medibank breach. It will be interesting to see the outcome.
      • bigiain 4y ago
        No it won't. We are totally toothless here. A few ignorant politicians trying to score points by sounding tough in the media isn't going to make any difference.
        • 4y ago
• andyp-kw 4y ago
  Props to Digital Ocean donating CPU time to a good cause.
• jinseokim 4y ago
  Where would be the sanest choice if I need some CPU computational resources (say, 10k CPU-hours)? Researchers simply used DigitalOcean (under their generous resource grants), but I believe there would be another better way for computing if I can't get such donation...
  • bufferoverflow 4y ago
    https://www.serverhunter.com https://www.serverhunter.com You can find much cheaper CPUs outside of the main cloud providers.
    • LoganDark 4y ago
      Woah, this website is awesome! Thank you!
  • zmgsabst 4y ago
    Just use AWS? At the moment, spot price on a m5.24xlarge is $1/hr for 96 cores and ~300GB of RAM. That’ll get it done for around $100 — assuming you can checkpoint and tolerate the risk of a shutdown. (The on-demand price is $4.60/h; $475 total.)
    • segfaultbuserr 4y ago
      Using the example in this article as a demo, on AWS, it takes $75 and 4 hours to crack a RSA-512 key, and it was the 2015 number. So it's certainly the correct choice here. https://arstechnica.com/information-technology/2015/10/breaking-512-bit-rsa-with-amazon-ec2-is-a-cinch-so-why-all-the-weak-keys/ https://arstechnica.com/information-technology/2015/10/break...
• yieldcrv 4y ago
  > Like Peter, Jon asked that his last name and that of his employer be omitted from the story, but he’s in charge of IT for a mid-sized managed service provider that got hit with Zeppelin in July 2020. Uhmmm…. this is an article about breaking a 3-piece puzzle using one piece of the puzzle and you give us this highly deductible information?
• some_developer 4y ago
  Last year I also learned that ransomware attackers are not computer gods, necessarily. My QNAP NAS was open to the internet (a forgotten but-not-in-use port forward on my router) and the famous QLocker ransomware got hold of it. I got out, I got really lucky. I've millions of files (useless to anyone in the world but me) on my NAS and the ransomware encryption took literally days. I probably discovered it on the 3rd day of its activity. Someone brighter than me already figured things out and posted this on the qnap forums, that there's a 7zip process running which encrypts the files and they process all files sequentially (aka: takes a long time in my case). This 7zip process gets executed for every file and gets passed the password for it on the command line, though in the process view it was masked for me. But I could just replace the invoked 7zip binary with a shell script and redirect all the arguments -> presto, I had the password. I then wrote some more shell scripts to decrypt all the files infected so far, wrote it more efficient than the attacker, and within 24 hours everything was back to normal. Before anyone cries "BACKUPS": yes, of course I've off-site backup and they also were not (yet) affected. But actually I only backed up the real important data for me and my family, due to the costs at that time, I didn't backup _everything_. But I since switched cloud backup storage to Backblaze which I figured was the cheapest vs. acceptable ergonomics for recovery, so I could increase the amount of data I back up. Lesson learned, I guess. I know not everyone can help themselves like I could, I feel really lucky I got away with just some blood sweating.
  • silviot 4y ago
    Interesting. So you're saying that the ransonware uses symmetric encryption, i.e. the same key is used to encrypt and decrypt. I always assumed it used asymmetric encryption, and that the decryption key would never hit the victim's premises. Definitely not computer gods.
    • edp 4y ago
      I think asymmetric encryption is not usable for large amount of data, the only thing it is good for is to encrypt a passphrase or a binary signature (like a hash). If you can catch the process of encryption while it is running, it is likely that the passphrase is in memory (or used as a command line argument).
• isolli 4y ago
  "It didn’t want to tip its hand to Zeppelin’s creators, who were likely to modify their file encryption approach if they detected it was somehow being bypassed." It reminds me of something I learned when watching the movie "The Imitation Game" retelling how Alan Turing and his team cracked the Enigma code. They tried hard to make sure that the Germans wouldn't notice they had cracked it, and only used it sparingly so that it would not be noticeable. Which, I realized, meant that the British and the Germans had teams of statisticians pitted against each other, one trying to make sure that their actions were not detectable statistically, and the other constantly monitoring the numbers to detect unusual patterns.
  • heavenlyblue 4y ago
    > Which, I realized, meant that the British and the Germans had teams of statisticians pitted against each other, That's probably not true from German side though.
    • isolli 4y ago
      At the very least, the British expected them to have statisticians actively involved in monitoring data.
      • bluGill 4y ago
        It wouldn't take the average (average, not great) general long to figure out that the enemy knows all their plans in advance if they don't take action to obscure that. A few times the worst possible counter is just bad luck, but only a few times and you know there is a leak. You might not know if it is a spy or your communications is monitored, but you can make a good guess that they know things they shouldn't.
  • nomel 4y ago
    That's a pretty grim requirement. I would guess that some people were allowed to be killed, to keep it a secret.
    • 4y ago
• jl2718 4y ago
  Why would the attacker use RSA-155? The obvious answer is data size because all of the files have a symmetric key that must be encrypted in the field size and communicated. Let's not go into any helpful discussions around that, but, I would like to ask if there is another reason. Perhaps the attacker uses the exact same procedure to crack their own keys because they have to assume that their private key is compromised and/or unsafe to use in a decryption scenario. Also, I just realized how cryptocurrency wallet draining happens with these infections. I thought it was because they scanned the whole drive for private keys and sent those separately. It seems it's probably more accidental: The user gets to send them one file to decrypt.
  • rocqua 4y ago
    For other confused readers, RSA with 512 bits uses 155 decimal digits. Hence RSA-155. This seems to be old notation from the RSA challenge that was clasiffied by the decimal length of numbers rather than the bit-length. Note that RSA-155bit is much worse than RSA-512bit. Both are insecure and should not be used, but you are still looking at the difference of "you need to rent a server farm to crack is" and "you need a laptop to crash it". I'm probably underselling how trivial RSA-155 is to crack.
• stiray 4y ago
  Maybe just to mention you an open-source, windows based countermeasure against ransomeware (and all other software that has tendency to trash its garbage all over the system disk). It should be widely known but unfortunately it isnt: https://sandboxie-plus.com/ https://sandboxie-plus.com/ You declare a sandbox and run program there (by default or context menu) and all the changes, including registry will be done as "copy-on-write" into sandboxie folder. Even uninstalling complex software like adobe photoshop is just deleting that folder. Here someone is teasing but running wannacry in a sandboxie: https://www.youtube.com/watch?v=bg5GaEVEYlE https://www.youtube.com/watch?v=bg5GaEVEYlE What ransonware will do in this case, it will open a file, but all the writes are going to be done within sandboxie directory leaving original files intact.
  • Kuinox 4y ago
    On windows pro/education/enterprise there is windows sandbox, available almost out of the box: https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview https://learn.microsoft.com/en-us/windows/security/threat-pr...
    • stiray 4y ago
      It is on completely different level, sandboxie doesnt use virtualization and is achieving its goal using API hooking. This means practically zero overhead.
      • devwastaken 4y ago
        Virtualization is almost zero overhead in modern day, and is safer. Breaking out of sandboxes has many more areas of exploitation.
      • xnyan 4y ago
        Windows sandbox overhead is quite low. I've played several games using it and the performance hit is in the low single digits, typically 2-5% in my experience. It's complicated but IMO virtualization seems to have less opportunities to fail vs a sandbox in terms of isolation.
• nomdep 4y ago
  Another reason to block all traffic from Russia and China
  • tengwar2 4y ago
    If you look at your logs of botnet attacks, most of the traffic is scattered evenly across the world, and cryptoware is probably similar. Ultimately the command and control will go back to Russia (usually), but firewalling Russia and China is unlikely to help much with any form of attach.
• deleted 4y ago
  [deleted]